(audit 6.2.1) CATValidator treats failed balanceOf() reads as zero#21
(audit 6.2.1) CATValidator treats failed balanceOf() reads as zero#21reednaa wants to merge 1 commit intots-libraryfrom
Conversation
…f silently returning 0.
|
Warning Rate limit exceeded
Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 37 minutes and 29 seconds. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (2)
📒 Files selected for processing (107)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## main #21 +/- ##
=======================================
Coverage ? 95.82%
=======================================
Files ? 14
Lines ? 2446
Branches ? 0
=======================================
Hits ? 2344
Misses ? 102
Partials ? 0 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
![aikido-pr-checks[bot]](https://avatars.githubusercontent.com/in/898896?s=60&v=4){kind=small}
|
|
||
| // forge-lint: disable-next-line(unchecked-call) | ||
| // wake-disable-next-line: unchecked-return-value | ||
| 0x4e59b44847b379578588920cA78FbF26c0B4956C.call{ gas: 1000000 }( |
There was a problem hiding this comment.
Large raw hex bytecode passed to an unchecked low-level .call. Replace with an explicit artifact or provide decoded source and justification so reviewers can inspect the deployed bytecode.
Details
✨ AI Reasoning
A deployment script now performs a low-level call to address 0x4e59b4... with an enormous raw hex payload. This call executes dynamically constructed bytecode via .call(...) with a hard-coded hex blob. Embedding large raw bytecode strings in source makes the payload opaque to reviewers and hides the actual operations being performed. This pattern can be used to hide malicious or unexpected behavior because the hex is not human-readable and cannot be easily reviewed without decoding. The code element is a direct runtime call that executes the provided bytes; that is the precise location where intent is obscured.
🔧 How do I fix it?
Ensure code is transparent and not intentionally obfuscated. Avoid hiding functionality from code review. Focus on intent and deception, not specific patterns.
Reply @AikidoSec feedback: [FEEDBACK] to get better review comments in the future.
Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info
2 participants
The Solady lib returns 0 balance if the
balanceOfcall fails. This could potentially be exploited if a non-0 token balance could be trigger to revert reporting user balance as 0 (instead of true amount).This PR fixes this issue by using the
checkBalanceOffunction from Solidity which returns a success boolean.A test has been included to validate the error.